The U.S. Court of Appeals for the Sixth Circuit ruled that the Federal Communications Commission’s 2024 Data Breach Reporting Rule is not “substantially the same” as the 2016 broadband-privacy regulation that Congress nullified under the Congressional Review Act (CRA). Writing for the 2-1 majority, Judge Jane Branstetter Stranch—joined by Judge Eric E. Murphy—concluded the 2024 rule targets only breach-notification obligations, whereas the 2016 regulation covered a far broader array of privacy requirements. Because the new measure addresses a narrower subject and contains material differences in reporting thresholds, definitions and notice requirements, the panel found the CRA’s bar on re-promulgating a previously disapproved rule does not apply. The decision in Ohio Telecom Association v. FCC is the first by a federal appeals court to interpret the CRA’s key phrase “substantially the same.” It rejects industry petitioners’ argument, adopted in Judge Raymond Kethledge Griffin’s dissent, that even limited overlap between the two rules should trigger the statutory prohibition. Absent Supreme Court review, the ruling preserves the FCC’s authority to require telecom and broadband providers to notify consumers and federal agencies when customer data are compromised. Beyond the immediate impact on breach-reporting obligations, the opinion gives regulators—and the companies they oversee—new guidance on how closely Congress’s disapproval resolutions constrain future agency action. It also sets an early precedent for post-Chevron administrative law, arriving just weeks after the Supreme Court’s Loper Bright decision eliminated mandatory judicial deference to agencies.